155714Skris/* crypto/bn/bn_lcl.h */ 255714Skris/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 355714Skris * All rights reserved. 455714Skris * 555714Skris * This package is an SSL implementation written 655714Skris * by Eric Young (eay@cryptsoft.com). 755714Skris * The implementation was written so as to conform with Netscapes SSL. 8280304Sjkim * 955714Skris * This library is free for commercial and non-commercial use as long as 1055714Skris * the following conditions are aheared to. The following conditions 1155714Skris * apply to all code found in this distribution, be it the RC4, RSA, 1255714Skris * lhash, DES, etc., code; not just the SSL code. The SSL documentation 1355714Skris * included with this distribution is covered by the same copyright terms 1455714Skris * except that the holder is Tim Hudson (tjh@cryptsoft.com). 15280304Sjkim * 1655714Skris * Copyright remains Eric Young's, and as such any Copyright notices in 1755714Skris * the code are not to be removed. 1855714Skris * If this package is used in a product, Eric Young should be given attribution 1955714Skris * as the author of the parts of the library used. 2055714Skris * This can be in the form of a textual message at program startup or 2155714Skris * in documentation (online or textual) provided with the package. 22280304Sjkim * 2355714Skris * Redistribution and use in source and binary forms, with or without 2455714Skris * modification, are permitted provided that the following conditions 2555714Skris * are met: 2655714Skris * 1. Redistributions of source code must retain the copyright 2755714Skris * notice, this list of conditions and the following disclaimer. 2855714Skris * 2. Redistributions in binary form must reproduce the above copyright 2955714Skris * notice, this list of conditions and the following disclaimer in the 3055714Skris * documentation and/or other materials provided with the distribution. 3155714Skris * 3. All advertising materials mentioning features or use of this software 3255714Skris * must display the following acknowledgement: 3355714Skris * "This product includes cryptographic software written by 3455714Skris * Eric Young (eay@cryptsoft.com)" 3555714Skris * The word 'cryptographic' can be left out if the rouines from the library 3655714Skris * being used are not cryptographic related :-). 37280304Sjkim * 4. If you include any Windows specific code (or a derivative thereof) from 3855714Skris * the apps directory (application code) you must include an acknowledgement: 3955714Skris * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" 40280304Sjkim * 4155714Skris * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND 4255714Skris * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 4355714Skris * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 4455714Skris * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 4555714Skris * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 4655714Skris * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 4755714Skris * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 4855714Skris * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 4955714Skris * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 5055714Skris * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 5155714Skris * SUCH DAMAGE. 52280304Sjkim * 5355714Skris * The licence and distribution terms for any publically available version or 5455714Skris * derivative of this code cannot be changed. i.e. this code cannot simply be 5555714Skris * copied and put under another distribution licence 5655714Skris * [including the GNU Public Licence.] 5755714Skris */ 5868651Skris/* ==================================================================== 5968651Skris * Copyright (c) 1998-2000 The OpenSSL Project. All rights reserved. 6068651Skris * 6168651Skris * Redistribution and use in source and binary forms, with or without 6268651Skris * modification, are permitted provided that the following conditions 6368651Skris * are met: 6468651Skris * 6568651Skris * 1. Redistributions of source code must retain the above copyright 66280304Sjkim * notice, this list of conditions and the following disclaimer. 6768651Skris * 6868651Skris * 2. Redistributions in binary form must reproduce the above copyright 6968651Skris * notice, this list of conditions and the following disclaimer in 7068651Skris * the documentation and/or other materials provided with the 7168651Skris * distribution. 7268651Skris * 7368651Skris * 3. All advertising materials mentioning features or use of this 7468651Skris * software must display the following acknowledgment: 7568651Skris * "This product includes software developed by the OpenSSL Project 7668651Skris * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" 7768651Skris * 7868651Skris * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 7968651Skris * endorse or promote products derived from this software without 8068651Skris * prior written permission. For written permission, please contact 8168651Skris * openssl-core@openssl.org. 8268651Skris * 8368651Skris * 5. Products derived from this software may not be called "OpenSSL" 8468651Skris * nor may "OpenSSL" appear in their names without prior written 8568651Skris * permission of the OpenSSL Project. 8668651Skris * 8768651Skris * 6. Redistributions of any form whatsoever must retain the following 8868651Skris * acknowledgment: 8968651Skris * "This product includes software developed by the OpenSSL Project 9068651Skris * for use in the OpenSSL Toolkit (http://www.openssl.org/)" 9168651Skris * 9268651Skris * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 9368651Skris * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 9468651Skris * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 9568651Skris * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 9668651Skris * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 9768651Skris * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 9868651Skris * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 9968651Skris * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 10068651Skris * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 10168651Skris * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 10268651Skris * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 10368651Skris * OF THE POSSIBILITY OF SUCH DAMAGE. 10468651Skris * ==================================================================== 10568651Skris * 10668651Skris * This product includes cryptographic software written by Eric Young 10768651Skris * (eay@cryptsoft.com). This product includes software written by Tim 10868651Skris * Hudson (tjh@cryptsoft.com). 10968651Skris * 11068651Skris */ 11155714Skris 11255714Skris#ifndef HEADER_BN_LCL_H 113280304Sjkim# define HEADER_BN_LCL_H 11455714Skris 115280304Sjkim# include <openssl/bn.h> 11655714Skris 11755714Skris#ifdef __cplusplus 11855714Skrisextern "C" { 11955714Skris#endif 12055714Skris 121280304Sjkim/*- 12268651Skris * BN_window_bits_for_exponent_size -- macro for sliding window mod_exp functions 12368651Skris * 12468651Skris * 12568651Skris * For window size 'w' (w >= 2) and a random 'b' bits exponent, 12668651Skris * the number of multiplications is a constant plus on average 12768651Skris * 12868651Skris * 2^(w-1) + (b-w)/(w+1); 12968651Skris * 13068651Skris * here 2^(w-1) is for precomputing the table (we actually need 13168651Skris * entries only for windows that have the lowest bit set), and 13268651Skris * (b-w)/(w+1) is an approximation for the expected number of 13368651Skris * w-bit windows, not counting the first one. 13468651Skris * 13568651Skris * Thus we should use 13668651Skris * 13768651Skris * w >= 6 if b > 671 13868651Skris * w = 5 if 671 > b > 239 13968651Skris * w = 4 if 239 > b > 79 14068651Skris * w = 3 if 79 > b > 23 14168651Skris * w <= 2 if 23 > b 14268651Skris * 14368651Skris * (with draws in between). Very small exponents are often selected 14468651Skris * with low Hamming weight, so we use w = 1 for b <= 23. 14568651Skris */ 146280304Sjkim# if 1 147280304Sjkim# define BN_window_bits_for_exponent_size(b) \ 148280304Sjkim ((b) > 671 ? 6 : \ 149280304Sjkim (b) > 239 ? 5 : \ 150280304Sjkim (b) > 79 ? 4 : \ 151280304Sjkim (b) > 23 ? 3 : 1) 152280304Sjkim# else 153280304Sjkim/* 154280304Sjkim * Old SSLeay/OpenSSL table. Maximum window size was 5, so this table differs 155280304Sjkim * for b==1024; but it coincides for other interesting values (b==160, 156280304Sjkim * b==512). 15768651Skris */ 158280304Sjkim# define BN_window_bits_for_exponent_size(b) \ 159280304Sjkim ((b) > 255 ? 5 : \ 160280304Sjkim (b) > 127 ? 4 : \ 161280304Sjkim (b) > 17 ? 3 : 1) 162280304Sjkim# endif 16368651Skris 164280304Sjkim/* 165280304Sjkim * BN_mod_exp_mont_conttime is based on the assumption that the L1 data cache 166280304Sjkim * line width of the target processor is at least the following value. 167160814Ssimon */ 168280304Sjkim# define MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH ( 64 ) 169280304Sjkim# define MOD_EXP_CTIME_MIN_CACHE_LINE_MASK (MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH - 1) 170160814Ssimon 171280304Sjkim/* 172280304Sjkim * Window sizes optimized for fixed window size modular exponentiation 173280304Sjkim * algorithm (BN_mod_exp_mont_consttime). To achieve the security goals of 174280304Sjkim * BN_mode_exp_mont_consttime, the maximum size of the window must not exceed 175280304Sjkim * log_2(MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH). Window size thresholds are 176280304Sjkim * defined for cache line sizes of 32 and 64, cache line sizes where 177280304Sjkim * log_2(32)=5 and log_2(64)=6 respectively. A window size of 7 should only be 178280304Sjkim * used on processors that have a 128 byte or greater cache line size. 179160814Ssimon */ 180280304Sjkim# if MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH == 64 181160814Ssimon 182160814Ssimon# define BN_window_bits_for_ctime_exponent_size(b) \ 183280304Sjkim ((b) > 937 ? 6 : \ 184280304Sjkim (b) > 306 ? 5 : \ 185280304Sjkim (b) > 89 ? 4 : \ 186280304Sjkim (b) > 22 ? 3 : 1) 187280304Sjkim# define BN_MAX_WINDOW_BITS_FOR_CTIME_EXPONENT_SIZE (6) 188160814Ssimon 189280304Sjkim# elif MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH == 32 190160814Ssimon 191160814Ssimon# define BN_window_bits_for_ctime_exponent_size(b) \ 192280304Sjkim ((b) > 306 ? 5 : \ 193280304Sjkim (b) > 89 ? 4 : \ 194280304Sjkim (b) > 22 ? 3 : 1) 195280304Sjkim# define BN_MAX_WINDOW_BITS_FOR_CTIME_EXPONENT_SIZE (5) 196160814Ssimon 197280304Sjkim# endif 198160814Ssimon 19955714Skris/* Pentium pro 16,16,16,32,64 */ 20055714Skris/* Alpha 16,16,16,16.64 */ 201280304Sjkim# define BN_MULL_SIZE_NORMAL (16)/* 32 */ 202280304Sjkim# define BN_MUL_RECURSIVE_SIZE_NORMAL (16)/* 32 less than */ 203280304Sjkim# define BN_SQR_RECURSIVE_SIZE_NORMAL (16)/* 32 */ 204280304Sjkim# define BN_MUL_LOW_RECURSIVE_SIZE_NORMAL (32)/* 32 */ 205280304Sjkim# define BN_MONT_CTX_SET_SIZE_WORD (64)/* 32 */ 20655714Skris 207280304Sjkim# if !defined(OPENSSL_NO_ASM) && !defined(OPENSSL_NO_INLINE_ASM) && !defined(PEDANTIC) 20859191Skris/* 20959191Skris * BN_UMULT_HIGH section. 21059191Skris * 21159191Skris * No, I'm not trying to overwhelm you when stating that the 21259191Skris * product of N-bit numbers is 2*N bits wide:-) No, I don't expect 21359191Skris * you to be impressed when I say that if the compiler doesn't 21459191Skris * support 2*N integer type, then you have to replace every N*N 21559191Skris * multiplication with 4 (N/2)*(N/2) accompanied by some shifts 21659191Skris * and additions which unavoidably results in severe performance 21759191Skris * penalties. Of course provided that the hardware is capable of 21859191Skris * producing 2*N result... That's when you normally start 21959191Skris * considering assembler implementation. However! It should be 22059191Skris * pointed out that some CPUs (most notably Alpha, PowerPC and 22159191Skris * upcoming IA-64 family:-) provide *separate* instruction 22259191Skris * calculating the upper half of the product placing the result 22359191Skris * into a general purpose register. Now *if* the compiler supports 22459191Skris * inline assembler, then it's not impossible to implement the 22559191Skris * "bignum" routines (and have the compiler optimize 'em) 22659191Skris * exhibiting "native" performance in C. That's what BN_UMULT_HIGH 22759191Skris * macro is about:-) 22859191Skris * 229280304Sjkim * <appro@fy.chalmers.se> 23059191Skris */ 231280304Sjkim# if defined(__alpha) && (defined(SIXTY_FOUR_BIT_LONG) || defined(SIXTY_FOUR_BIT)) 232280304Sjkim# if defined(__DECC) 233280304Sjkim# include <c_asm.h> 234280304Sjkim# define BN_UMULT_HIGH(a,b) (BN_ULONG)asm("umulh %a0,%a1,%v0",(a),(b)) 235280304Sjkim# elif defined(__GNUC__) && __GNUC__>=2 236280304Sjkim# define BN_UMULT_HIGH(a,b) ({ \ 237280304Sjkim register BN_ULONG ret; \ 238280304Sjkim asm ("umulh %1,%2,%0" \ 239280304Sjkim : "=r"(ret) \ 240280304Sjkim : "r"(a), "r"(b)); \ 241280304Sjkim ret; }) 242280304Sjkim# endif /* compiler */ 243280304Sjkim# elif defined(_ARCH_PPC) && defined(__64BIT__) && defined(SIXTY_FOUR_BIT_LONG) 244280304Sjkim# if defined(__GNUC__) && __GNUC__>=2 245280304Sjkim# define BN_UMULT_HIGH(a,b) ({ \ 246280304Sjkim register BN_ULONG ret; \ 247280304Sjkim asm ("mulhdu %0,%1,%2" \ 248280304Sjkim : "=r"(ret) \ 249280304Sjkim : "r"(a), "r"(b)); \ 250280304Sjkim ret; }) 251280304Sjkim# endif /* compiler */ 252280304Sjkim# elif (defined(__x86_64) || defined(__x86_64__)) && \ 253238405Sjkim (defined(SIXTY_FOUR_BIT_LONG) || defined(SIXTY_FOUR_BIT)) 254280304Sjkim# if defined(__GNUC__) && __GNUC__>=2 255280304Sjkim# define BN_UMULT_HIGH(a,b) ({ \ 256280304Sjkim register BN_ULONG ret,discard; \ 257280304Sjkim asm ("mulq %3" \ 258280304Sjkim : "=a"(discard),"=d"(ret) \ 259280304Sjkim : "a"(a), "g"(b) \ 260280304Sjkim : "cc"); \ 261280304Sjkim ret; }) 262280304Sjkim# define BN_UMULT_LOHI(low,high,a,b) \ 263280304Sjkim asm ("mulq %3" \ 264280304Sjkim : "=a"(low),"=d"(high) \ 265280304Sjkim : "a"(a),"g"(b) \ 266280304Sjkim : "cc"); 267280304Sjkim# endif 268280304Sjkim# elif (defined(_M_AMD64) || defined(_M_X64)) && defined(SIXTY_FOUR_BIT) 269280304Sjkim# if defined(_MSC_VER) && _MSC_VER>=1400 270280304Sjkimunsigned __int64 __umulh(unsigned __int64 a, unsigned __int64 b); 271280304Sjkimunsigned __int64 _umul128(unsigned __int64 a, unsigned __int64 b, 272280304Sjkim unsigned __int64 *h); 273280304Sjkim# pragma intrinsic(__umulh,_umul128) 274280304Sjkim# define BN_UMULT_HIGH(a,b) __umulh((a),(b)) 275280304Sjkim# define BN_UMULT_LOHI(low,high,a,b) ((low)=_umul128((a),(b),&(high))) 276280304Sjkim# endif 277280304Sjkim# elif defined(__mips) && (defined(SIXTY_FOUR_BIT) || defined(SIXTY_FOUR_BIT_LONG)) 278280304Sjkim# if defined(__GNUC__) && __GNUC__>=2 279284285Sjkim# if __GNUC__>4 || (__GNUC__>=4 && __GNUC_MINOR__>=4) 280280304Sjkim /* "h" constraint is no more since 4.4 */ 281280304Sjkim# define BN_UMULT_HIGH(a,b) (((__uint128_t)(a)*(b))>>64) 282280304Sjkim# define BN_UMULT_LOHI(low,high,a,b) ({ \ 283280304Sjkim __uint128_t ret=(__uint128_t)(a)*(b); \ 284280304Sjkim (high)=ret>>64; (low)=ret; }) 285280304Sjkim# else 286280304Sjkim# define BN_UMULT_HIGH(a,b) ({ \ 287280304Sjkim register BN_ULONG ret; \ 288280304Sjkim asm ("dmultu %1,%2" \ 289280304Sjkim : "=h"(ret) \ 290280304Sjkim : "r"(a), "r"(b) : "l"); \ 291280304Sjkim ret; }) 292246772Sjkim# define BN_UMULT_LOHI(low,high,a,b)\ 293280304Sjkim asm ("dmultu %2,%3" \ 294280304Sjkim : "=l"(low),"=h"(high) \ 295280304Sjkim : "r"(a), "r"(b)); 296246772Sjkim# endif 297280304Sjkim# endif 298280304Sjkim# endif /* cpu */ 299280304Sjkim# endif /* OPENSSL_NO_ASM */ 30055714Skris 30155714Skris/************************************************************* 30255714Skris * Using the long long type 30355714Skris */ 304280304Sjkim# define Lw(t) (((BN_ULONG)(t))&BN_MASK2) 305280304Sjkim# define Hw(t) (((BN_ULONG)((t)>>BN_BITS2))&BN_MASK2) 30655714Skris 307280304Sjkim# ifdef BN_DEBUG_RAND 308280304Sjkim# define bn_clear_top2max(a) \ 309280304Sjkim { \ 310280304Sjkim int ind = (a)->dmax - (a)->top; \ 311280304Sjkim BN_ULONG *ftl = &(a)->d[(a)->top-1]; \ 312280304Sjkim for (; ind != 0; ind--) \ 313280304Sjkim *(++ftl) = 0x0; \ 314280304Sjkim } 315280304Sjkim# else 316280304Sjkim# define bn_clear_top2max(a) 317280304Sjkim# endif 31855714Skris 319280304Sjkim# ifdef BN_LLONG 320280304Sjkim# define mul_add(r,a,w,c) { \ 321280304Sjkim BN_ULLONG t; \ 322280304Sjkim t=(BN_ULLONG)w * (a) + (r) + (c); \ 323280304Sjkim (r)= Lw(t); \ 324280304Sjkim (c)= Hw(t); \ 325280304Sjkim } 32655714Skris 327280304Sjkim# define mul(r,a,w,c) { \ 328280304Sjkim BN_ULLONG t; \ 329280304Sjkim t=(BN_ULLONG)w * (a) + (c); \ 330280304Sjkim (r)= Lw(t); \ 331280304Sjkim (c)= Hw(t); \ 332280304Sjkim } 33355714Skris 334280304Sjkim# define sqr(r0,r1,a) { \ 335280304Sjkim BN_ULLONG t; \ 336280304Sjkim t=(BN_ULLONG)(a)*(a); \ 337280304Sjkim (r0)=Lw(t); \ 338280304Sjkim (r1)=Hw(t); \ 339280304Sjkim } 34059191Skris 341280304Sjkim# elif defined(BN_UMULT_LOHI) 342280304Sjkim# define mul_add(r,a,w,c) { \ 343280304Sjkim BN_ULONG high,low,ret,tmp=(a); \ 344280304Sjkim ret = (r); \ 345280304Sjkim BN_UMULT_LOHI(low,high,w,tmp); \ 346280304Sjkim ret += (c); \ 347280304Sjkim (c) = (ret<(c))?1:0; \ 348280304Sjkim (c) += high; \ 349280304Sjkim ret += low; \ 350280304Sjkim (c) += (ret<low)?1:0; \ 351280304Sjkim (r) = ret; \ 352280304Sjkim } 353160814Ssimon 354280304Sjkim# define mul(r,a,w,c) { \ 355280304Sjkim BN_ULONG high,low,ret,ta=(a); \ 356280304Sjkim BN_UMULT_LOHI(low,high,w,ta); \ 357280304Sjkim ret = low + (c); \ 358280304Sjkim (c) = high; \ 359280304Sjkim (c) += (ret<low)?1:0; \ 360280304Sjkim (r) = ret; \ 361280304Sjkim } 362160814Ssimon 363280304Sjkim# define sqr(r0,r1,a) { \ 364280304Sjkim BN_ULONG tmp=(a); \ 365280304Sjkim BN_UMULT_LOHI(r0,r1,tmp,tmp); \ 366280304Sjkim } 367160814Ssimon 368280304Sjkim# elif defined(BN_UMULT_HIGH) 369280304Sjkim# define mul_add(r,a,w,c) { \ 370280304Sjkim BN_ULONG high,low,ret,tmp=(a); \ 371280304Sjkim ret = (r); \ 372280304Sjkim high= BN_UMULT_HIGH(w,tmp); \ 373280304Sjkim ret += (c); \ 374280304Sjkim low = (w) * tmp; \ 375280304Sjkim (c) = (ret<(c))?1:0; \ 376280304Sjkim (c) += high; \ 377280304Sjkim ret += low; \ 378280304Sjkim (c) += (ret<low)?1:0; \ 379280304Sjkim (r) = ret; \ 380280304Sjkim } 38159191Skris 382280304Sjkim# define mul(r,a,w,c) { \ 383280304Sjkim BN_ULONG high,low,ret,ta=(a); \ 384280304Sjkim low = (w) * ta; \ 385280304Sjkim high= BN_UMULT_HIGH(w,ta); \ 386280304Sjkim ret = low + (c); \ 387280304Sjkim (c) = high; \ 388280304Sjkim (c) += (ret<low)?1:0; \ 389280304Sjkim (r) = ret; \ 390280304Sjkim } 39159191Skris 392280304Sjkim# define sqr(r0,r1,a) { \ 393280304Sjkim BN_ULONG tmp=(a); \ 394280304Sjkim (r0) = tmp * tmp; \ 395280304Sjkim (r1) = BN_UMULT_HIGH(tmp,tmp); \ 396280304Sjkim } 39759191Skris 398280304Sjkim# else 39955714Skris/************************************************************* 40055714Skris * No long long type 40155714Skris */ 40255714Skris 403280304Sjkim# define LBITS(a) ((a)&BN_MASK2l) 404280304Sjkim# define HBITS(a) (((a)>>BN_BITS4)&BN_MASK2l) 405280304Sjkim# define L2HBITS(a) (((a)<<BN_BITS4)&BN_MASK2) 40655714Skris 407280304Sjkim# define LLBITS(a) ((a)&BN_MASKl) 408280304Sjkim# define LHBITS(a) (((a)>>BN_BITS2)&BN_MASKl) 409280304Sjkim# define LL2HBITS(a) ((BN_ULLONG)((a)&BN_MASKl)<<BN_BITS2) 41055714Skris 411280304Sjkim# define mul64(l,h,bl,bh) \ 412280304Sjkim { \ 413280304Sjkim BN_ULONG m,m1,lt,ht; \ 41455714Skris \ 415280304Sjkim lt=l; \ 416280304Sjkim ht=h; \ 417280304Sjkim m =(bh)*(lt); \ 418280304Sjkim lt=(bl)*(lt); \ 419280304Sjkim m1=(bl)*(ht); \ 420280304Sjkim ht =(bh)*(ht); \ 421280304Sjkim m=(m+m1)&BN_MASK2; if (m < m1) ht+=L2HBITS((BN_ULONG)1); \ 422280304Sjkim ht+=HBITS(m); \ 423280304Sjkim m1=L2HBITS(m); \ 424280304Sjkim lt=(lt+m1)&BN_MASK2; if (lt < m1) ht++; \ 425280304Sjkim (l)=lt; \ 426280304Sjkim (h)=ht; \ 427280304Sjkim } 42855714Skris 429280304Sjkim# define sqr64(lo,ho,in) \ 430280304Sjkim { \ 431280304Sjkim BN_ULONG l,h,m; \ 43255714Skris \ 433280304Sjkim h=(in); \ 434280304Sjkim l=LBITS(h); \ 435280304Sjkim h=HBITS(h); \ 436280304Sjkim m =(l)*(h); \ 437280304Sjkim l*=l; \ 438280304Sjkim h*=h; \ 439280304Sjkim h+=(m&BN_MASK2h1)>>(BN_BITS4-1); \ 440280304Sjkim m =(m&BN_MASK2l)<<(BN_BITS4+1); \ 441280304Sjkim l=(l+m)&BN_MASK2; if (l < m) h++; \ 442280304Sjkim (lo)=l; \ 443280304Sjkim (ho)=h; \ 444280304Sjkim } 44555714Skris 446280304Sjkim# define mul_add(r,a,bl,bh,c) { \ 447280304Sjkim BN_ULONG l,h; \ 44855714Skris \ 449280304Sjkim h= (a); \ 450280304Sjkim l=LBITS(h); \ 451280304Sjkim h=HBITS(h); \ 452280304Sjkim mul64(l,h,(bl),(bh)); \ 45355714Skris \ 454280304Sjkim /* non-multiply part */ \ 455280304Sjkim l=(l+(c))&BN_MASK2; if (l < (c)) h++; \ 456280304Sjkim (c)=(r); \ 457280304Sjkim l=(l+(c))&BN_MASK2; if (l < (c)) h++; \ 458280304Sjkim (c)=h&BN_MASK2; \ 459280304Sjkim (r)=l; \ 460280304Sjkim } 46155714Skris 462280304Sjkim# define mul(r,a,bl,bh,c) { \ 463280304Sjkim BN_ULONG l,h; \ 46455714Skris \ 465280304Sjkim h= (a); \ 466280304Sjkim l=LBITS(h); \ 467280304Sjkim h=HBITS(h); \ 468280304Sjkim mul64(l,h,(bl),(bh)); \ 46955714Skris \ 470280304Sjkim /* non-multiply part */ \ 471280304Sjkim l+=(c); if ((l&BN_MASK2) < (c)) h++; \ 472280304Sjkim (c)=h&BN_MASK2; \ 473280304Sjkim (r)=l&BN_MASK2; \ 474280304Sjkim } 475280304Sjkim# endif /* !BN_LLONG */ 47655714Skris 477280304Sjkim# if defined(OPENSSL_DOING_MAKEDEPEND) && defined(OPENSSL_FIPS) 478280304Sjkim# undef bn_div_words 479280304Sjkim# endif 480238405Sjkim 481280304Sjkimvoid bn_mul_normal(BN_ULONG *r, BN_ULONG *a, int na, BN_ULONG *b, int nb); 482280304Sjkimvoid bn_mul_comba8(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b); 483280304Sjkimvoid bn_mul_comba4(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b); 484109998Smarkmvoid bn_sqr_normal(BN_ULONG *r, const BN_ULONG *a, int n, BN_ULONG *tmp); 485280304Sjkimvoid bn_sqr_comba8(BN_ULONG *r, const BN_ULONG *a); 486280304Sjkimvoid bn_sqr_comba4(BN_ULONG *r, const BN_ULONG *a); 487280304Sjkimint bn_cmp_words(const BN_ULONG *a, const BN_ULONG *b, int n); 488280304Sjkimint bn_cmp_part_words(const BN_ULONG *a, const BN_ULONG *b, int cl, int dl); 489280304Sjkimvoid bn_mul_recursive(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n2, 490280304Sjkim int dna, int dnb, BN_ULONG *t); 491280304Sjkimvoid bn_mul_part_recursive(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, 492280304Sjkim int n, int tna, int tnb, BN_ULONG *t); 493280304Sjkimvoid bn_sqr_recursive(BN_ULONG *r, const BN_ULONG *a, int n2, BN_ULONG *t); 494280304Sjkimvoid bn_mul_low_normal(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n); 495280304Sjkimvoid bn_mul_low_recursive(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n2, 496280304Sjkim BN_ULONG *t); 497280304Sjkimvoid bn_mul_high(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, BN_ULONG *l, int n2, 498280304Sjkim BN_ULONG *t); 499160814SsimonBN_ULONG bn_add_part_words(BN_ULONG *r, const BN_ULONG *a, const BN_ULONG *b, 500280304Sjkim int cl, int dl); 501160814SsimonBN_ULONG bn_sub_part_words(BN_ULONG *r, const BN_ULONG *a, const BN_ULONG *b, 502280304Sjkim int cl, int dl); 503280304Sjkimint bn_mul_mont(BN_ULONG *rp, const BN_ULONG *ap, const BN_ULONG *bp, 504280304Sjkim const BN_ULONG *np, const BN_ULONG *n0, int num); 50555714Skris 50655714Skris#ifdef __cplusplus 50755714Skris} 50855714Skris#endif 50955714Skris 51055714Skris#endif 511